Hacker News Reader

Comment by z3t4 | Hacker News Reader

Before "tree shaking" I stored all npm modules in SCM and reviwed all updates as I had to commit after "npm update". I also put ton of files in .ignore as 90% of files in some packages are not required. I also used to include npm modules in distribution/deployment. So my request to npm is to add an option in the main package.json to disable tree shaking.

View on HN

I wish there was a way to "bless" packages when they were reviewed.

I want a network of trust, such that a Google reviewed package is worth 10 points, a package fuzzed by foobar is worth 2 points, something skimmed by a dependant user is worth 1 point etc.

I can then chose a compromise between a highly rated/reviewed dependencies and functionality/risk/cost-to-review.

My own blessing of a package I have reviewed might become a very small signal in a web of trust.

For Rust there is at least one tool for this that I've started using, although I don't think it's very widely used: https://github.com/dpc/crev/tree/master/cargo-crev

Ironically this depends on a whole slew of additional packages I haven't yet reviewed to build ;)

Very recently (2 commits starting 8 days ago) someone started on an npm equivalent but it's not in a usable state yet: https://github.com/kspaans/npm-crev/blob/master/TODO.md

Two problems - few people out there reviewing code, and poor discoverability for who else is reviewing code that you might trust at the moment.

You may find npms.io[1] useful. For each package, they provide a score on maintainability, popularity and quality.

[1] https://npms.io

npms.io rates the `rate-map` package with quality 99%, so not sure how helpful that is

Interesting! I thibk this is a good start but I guess it would still need some thought to be resistant to sybil attacks.

BTW: I used to think the dependencies that came as part of for example the official Angular packages where vetted.

Can anyone confirm or deny this?

Anyone can

I would not at all trust a "Google" reviewed package, not for their penchant privacy violations and writing code to fuel them.

I assume the idea is that, even if Google violates their user’s privacy, they take care not to let others violate their user’s privacy through their dependencies.

I evaluated wordpress plugins this way, a good way to check if something strange had crept in.

By the ignored files do you mean non-code?

Take the most popular npm module lodash for example. It has over one thousand files! But you probably only need one (lodash.js) and that's the one I would commit to SCM.

I think they mean code - just remove all files that your program doesn't touch. With something like JS, this should be doable in cases because of the way libraries tend to be designed.

The equivalent in a compiled language would be to strip unused symbols from the binary.

Reply on news.ycombinator.com